User interface and method for control of medical instruments, such as dialysis machines

ABSTRACT

A user interface for a medical instrument such as a dialysis machine is described which uses both a touch screen and at least one hard key off of the touch screen to effectuate a change in a parameter associated with the operation of the machine or the treatment session. The user interface is connected to a central computer control system having a host microprocessor and a backup safety microprocessor. The hard key is directly wired to the safety microprocessor. After the user selects a new parametric value on the touch screen, the user presses a hard key. The host and safety microprocessors implement a verification routine to insure that the entered parameter is appropriate for the patient&#39;s treatment and the display on the touch screen. If the verification procedure ends in a positive result, the user is prompted to presses a second hard key to confirm the change, causing an additional verification check to be performed. If the additional verification check is successful, the parametric value is entered into a memory (such as a hard disk) storing instructions for operation of the medical instrument.

RELATED APPLICATIONS

This application is a continuation-in-part of application Ser. No.08/559,933 filed Feb. 5, 1996, now U.S. Pat. No. 5,647,397, which is adivisional of application Ser. No. 08/388,275 filed Feb. 13, 1995, nowU.S. Pat. 5,591,344. This application is also a continuation in part ofapplication Ser. No. 29/052,303 filed Apr. 1, 1996, now U.S. Pat. D383,842.

NOTICE REGARDING COPYRIGHT

A portion of the disclosure of this patent document contains mattersubject to copyright protection. The copyright owner has no objection tothe facsimile reproduction by anyone of the patent disclosure, as itappears in the Patent and Trademark Office files and records, butotherwise retains all copyright rights whatsoever.

BACKGROUND OF THE INVENTION

A. Field of the Invention

This invention relates to the field of medical instruments and theiruser interfaces, and more particularly to a user interface and controlmethod for a medical instrument such as a dialysis machine.

B. Description of Related Art

Dialysis machine are used for treating patients with inadequate kidneyfunction. Hemodialysis machines typically include, among other things,an extracorporeal blood circuit comprising an arterial line, a bloodpump, a dialyzer having a semipermeable membrane and a venous line.Blood is removed from the patient and pumped by the blood pump throughthe arterial line to the blood compartment of the dialyzer, where toxinsand excess water are removed from the patient's blood. A dialysatesolution is circulated on the other side of the membrane and carriesaway the toxins and removed water. The blood is then returned to thepatient via the venous line. Peritoneal dialysis machines prepare adialysate solution which is introduced into the patient's peritonealcavity.

Dialysis machines typically have some sort of controls to regulate theoperation of the machine. Such controls in the past were a ratherunattractive and hard to use set of dials and switches that requiredtrained medical professionals to use properly. More contemporarymachines have a single user interface to allow a patient or medicalpractitioner to interact with the machine and adjust machine operationor treatment parameters, e.g., blood pump rate, dialysate temperature orflow rate, treatment time, heparin pump rate, etc.

The patent to Grogan et al., U.S. Pat. No. 5,326,476, which isincorporated by reference herein, describes a touch screen that is usedto control the operation of a hemodialysis machine. The touch screen isconnected to a host microprocessor which controls operation of most ofthe active components of the machine. When the user wishes to change atreatment parameter, the user touches an icon on the touch screen and akey pad with an enter key pops up on the screen. The user enters the newvalue by touching the numbers on the key pad and pressing the enterbutton on the key pad. A verify button is then pressed on the touchscreen if the user wishes to confirm the change. The patent also brieflydescribes a method of touching the touch screen to program atime-varying parameter, such as ultrafiltration removal over the courseof a dialysis session.

User interfaces that solely depend on a touch screen as a means forentering and confirming parametric values, such as described in theGrogan et al. patent, are vulnerable to failures in the touch screendisplay. If the touch screen is defective, the computer system may notreceive the correct information from the touch screen or interpret theinformation incorrectly. The present invention was designed to providefor redundancy and safety verification of parametric value changesindependent of the operation of the touch screen, and thereby avoidaccidental or unintended changes of parameters in the event of a defectin the touch screen.

The user interface of the present invention provides for the combinationof a touch screen, and at least one hard key that are separate and apartfrom the touch screen, whereby both the touch screen and the hard keyshave to be pressed to enter and verify a change in a parametric valuepertinent to the treatment or the operation of the machine. The computercontrol system for the machine also uses host and safety backupmicroprocessors which are responsive to the touch screen and hard keysto perform internal verification and confirmation checking procedures toverify that the change in parametric value requested by the user isproper. These features combine to offer safety benefits, robustness, andease of use that are believed to be superior to user interfaces known inthe prior art.

Another object of the invention is to provide a user interface designfor a medical instrument that is especially easy to use by a person thatis not a technically trained medical professional, i.e., by the patientor a member of the patient's family.

SUMMARY OF THE INVENTION

A system for controlling the operation of a dialysis machine is providedcomprising in combination a user interface and a central computercontrol system. The user interface comprises a touch screen thatdisplays messages and information as to the machine status to a user,and permits the user to touch the touch screen to select parametricvalues pertinent to operation of the machine. The user interface furtherincludes at least one hard key off of the touch screen. The touch screenprompts the user to press the hard key to signify that the selection ofthe parametric value by the user has been completed.

The central computer control system controls operation of the machineand is responsive to the touch screen and the hard key. The controlsystem comprises a host central processing unit and a safety centralprocessing unit (both comprising microprocessors) operatively connectedto each other so as to enable an exchange of information related to theselected parametric value.

When the user presses the hard key to indicate that the selectionprocess is complete, this action causes the host and safetymicroprocessors to undergo a verification routine whereby the selectedparametric value is checked for appropriateness for a patient connectedto the machine so as to prevent changes to the parameter potentiallyharmful to the patient. If the verification routine results in apositive result, the process of changing the parameter may move forward.

In a preferred embodiment, the hard key is directly wired to the safetycentral processing unit. The user interface also preferably comprisesfirst, second and third hard keys, each of them directly wired to thesafety central processing unit. The hard keys are preferably given adistinctive appearance so as to enable the user to identify each hardkey with a distinct functional attribute, e.g., stop, confirm, or entry.

In another aspect of the invention, a method of operation of a dialysismachine is provided, the machine having a central computer controlsystem and a user interface having a touch screen enabling a patient, bytouching the touch screen, to select parametric values in a process ofchanging a parametric value pertinent to operation of the machine or toa dialysis treatment of a patient connected to the machine. The methodcomprises providing the user interface with at least one hard key andconnecting the hard key directly to the central computer control system.After the user has selected the parametric value by touching the touchscreen, the user is prompted to press the hard key to either

(a) enter the parametric value selected, or,

(b) if entry of the selected parametric value was accomplished bytouching the touch screen, confirm the entry of the parametric value.

In accordance with the above method, a failure in the touch screen torespond to touching of the touch screen to either enter or confirmparametric value changes may be avoided.

In one embodiment of the invention, the central computer control systemfor the machine preferably includes host and safety CPUs, eachcomprising a microprocessor. The host and safety microprocessors eachhave has a first memory such as a random access memory (RAM) and asecond memory, such as a hard disk, storing machine operationinstructions and treatment prescriptions. In one aspect of theinvention, a method is provided for using the touch screen, two hardkeys, the first and second memories and host and safety microprocessorsto change parameters to provide enhanced redundancy and safetycapabilities and avoid single point failures in the touch screen, hostmicroprocessor, or host memories. The method comprises the steps of:

a) touching the touch screen to select a parametric value;

b) pressing the first hard key to enter the selected parametric value,the computer system responsively storing the selected parametric valuein the first memory is associated with the host microprocessor;

c) in response to pressing the first hard key, transmitting dataassociated with the selected value from the host microprocessor to thesafety microprocessor and implementing a verification routine in thesafety microprocessor. The safety microprocessor checks the parametricvalue for appropriateness for a patient connected to the machine so asto prevent changes from being implemented to the parameter potentiallyharmful to the patent.

d) If the verification routine has a positive result, the safety sends asignal back to the host microprocessor granting approval to the changeand stores the changed parameter in its first memory. The touch screenthen displays a message prompting the user to press the second hard keyto confirm the change selected in step a).

e) If the user presses the second hard key to confirm the change, thehost and safety microprocessors stores the new value in their respectivesecond memories. The host and safety microprocessors then conduct achecking procedure to insure that the new value has been correctlystored in their second memories.

These and many other aspects and features of the invention will be moreapparent from the following detailed description of preferredembodiments of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following detailed description of presently preferred andalternative embodiments of the invention, reference will be made to theaccompanying drawing figures, in which like reference numerals refer tolike elements in the various views, and in which:

FIG. 1 is an illustration of a dialysis machine having a user interfacein accordance with a preferred embodiment of the invention.

FIG. 2 is a cross-sectional view of the user interface in an embodimentin which the arm connecting the user interface to the machine isattached to the lower cabinet of the machine;

FIG. 3 is a block diagram of a control system governing the operation ofthe machine of FIG. 1.

FIG. 4 is an elevational view of the user interface for the machine ofFIG. 1, showing the general organization of the screen into discreteregions associated with different general functions.

FIG. 5 is an illustration of the user interface of FIG. 4, with thetouch screen displaying a dialysis prescription during a treatmentsession, the display requesting the patient to press an icon associatedwith a treatment parameter if they wish to change a parameter.

FIG. 6 is an illustration of the user interface of FIG. 1 after the userhas pressed the icon shown in FIG. 5, showing up and down arrows thatpermit the user to select a different value for the treatment parameter.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

FIG. 1 is an illustration of a dialysis machine 10 having a userinterface 12 which may be employed in practicing the invention. Thedialysis machine 10 in the preferred embodiment is a machine suitablefor use outside of a traditional dialysis clinic setting, such as thehome, nursing home or self-care clinic environment. The user interface12 is designed to be easy to use by a person other than a trained healthcare professional, such as the patient or a family member of thepatient.

The preferred user interface 12 comprises a transparent touch screen 14,a display positioned immediately behind the touch screen 14, and a setof three hard keys or buttons 16, 18, 20 positioned below the touchscreen 14. The touch screen 14 and hard keys 16, 18 and 20 areincorporated into a rigid housing 15 that is mounted to the distal endof a moveable arm 30.

The machine 10 has a central computer control system 100 shown in blockdiagram form in FIG. 3. The control system 100 is programmed to displayinformation and messages to the patient or user of the machine on adisplay 14' (FIG. 2) immediately behind the touch screen surface 14. Thecontrol system 100, in cooperation with the hard keys 16, 18, 20 andtouch screen 14, permits the user to change machine settings and enterinformation and otherwise control the operation of the machine before,during and after the treatment time.

The dialysis machine 10 of FIG. 1 has a water treatment module 23 and adialysate preparation module 25 contained within the lower compartment22 of the machine. These modules 23, 25 play no part in the presentinvention, and are described in detail in U.S. Pat. No. 5,591,344 toKenley et al. and assigned to Aksys, Ltd., the assignee of the presentinvention, and in PCT application publication no. WO 96/25214. Thesereferences describe a preferred dialysis machine suitable for use in thehome environment. The Kenley et al. U.S. Pat. No. 5,591,344 andpublished PCT application no. WO 96/25214 are both fully incorporated byreference herein. Additionally, the manner in which the dialysatesolutions are prepared and circulated through the dialysate circuit isnot particularly important to this invention and is well known in theart, and may be as described in the above-referenced Kenley et al.patent, or as described in the above-referenced Grogan et al. patent, orotherwise. Additionally, the user interface and method of operation isapplicable to other types of medical instruments.

The dialysis machine 10 further includes an extracorporeal circuit 24mounted above the lower cabinet 22. The extracorporeal circuit is housedbehind a door 27 in an enclosure 26 that is mounted to a turntable 28.The turntable 28 is moveably mounted to the top of the lower cabinet 22such that the turntable 28, enclosure 26 and extracorporeal circuit 24are capable of rotation as a unit relative to the lower cabinet 22 abouta vertical axis. The purpose of this rotation is to allow theextracorporeal circuit within the door 27 to be placed directly oppositea patient sitting next to the machine 10.

The details of the extracorporeal circuit 24 of the machine 10 of FIG. 1are also not particularly germane to the present dialysis machine userinterface. Blood is removed from the patient and introduced into anarterial line, and pumped by a blood pump to the blood chamber of adialyzer. Blood-borne toxins and excess water are removed from the bloodthrough the membrane of the dialyzer, and the blood is returned to thepatient via a venous line. To prevent air from being introduced into theblood being returned to the patient, it is conventional in the dialysisart to place an air trap in the venous line. A method of using the userinterface 12 to adjust the level in the air trap is described in a U.S.patent application of Rodney S. Kenley et al., Ser. No. 08/799,227 filedFeb. 14, 1997, filed concurrently, which is incorporated by referenceherein. Details of the extracorporeal circuit illustrated in FIG. 1 canbe found in the published PCT application of Kenley et al., publicationno. WO 96/25214 and in the Kenley et al. U.S. Pat. No. 5,591,344.

The proximal end of the moveable arm 30 may be either attached to theenclosure 26 via a hinge 29 as shown in FIG. 1, to the turntable 28, orto the lower cabinet 22 as shown in FIG. 2, such as to a corner of theupper surface of the lower cabinet, e.g., corner 32. Preferably, theuser interface arm 30 is connected to the rest of the machine 10 via ahinge 29 or other suitable means such that the arm 30 can rotate aboutthe vertical axis so as to position the user interface in a convenientorientation relative to a patient sitting or reclining next to themachine.

The user interface 12 of FIG. 1 is shown in cross section in FIG. 2,along the lines 2--2 of FIG. 1, in an embodiment in which the arm 30 isconnected to the upper surface of the machine housing 22 at the corner32. A hinge 29 connects the proximal end of the arm 30 to the housing 22and allows the arm 30 to pivot about a vertical axis. A second hinge 49at the distal portion of the arm 30 allows the user interface 12 topivot about a vertical axis. A third hinge 47 in the user interfacehousing 15 allows the user interface 12 to tilt about a horizontal axis,i.e., to tilt down towards the patient if the patient is seated orreclining in bed, or up if the patient is standing.

The extreme lower portion of the user interface housing 15 has a lowerhandle portion 17 below the hard keys 16, 18, 20. The handle 17 has anextreme lower lip 17A that allows the user to grasp the interfacehousing 15, and a relatively large surface 17B extending across asubstantial portion of the width of the housing that allows the user topush the user interface back, causing the arm 30 to move about the hinge29, or rotate about the tilt hinge 47. The addition of a handle featureas described allows the user to interact with a specific portion of theuser interface 12 away from the touch screen 14, whereby the user isless likely to push the touch screen 14 to move the touch screen aboutand accidentally operate the controls of the machine 10. The lower lip17A and front surface 17B thus enable a user to manually manipulate theuser interface housing 15 in a manner to cause rotation of the userinterface about the housing axis H of FIGS. 1 and 3, the arm axis A, andthe tilt axis T.

The front of the user interface housing 15 is substantially flat andincludes the substantially transparent touch screen 14 per se. Thedisplay 14' for the touch screen is placed within the housingimmediately behind the touch screen 14. The hard keys 16, 18, 30 arebuilt into the front surface of the housing 15 immediately below thetouch screen 14.

FIG. 3 is a block diagram of a computer control system module 100installed in the lower cabinet 22 of the machine 10 that governs theoperation of the machine. The use of a central computer control moduleto control active components of a dialysis machine is well known in theart and described in the above-referenced Kenley et al. and Grogan etal. patents. The module 100 controls the operation of the touch screendisplay 14' to display messages and information concerning the status ofthe machine and treatment. The module 100 operates the touch screendisplay 14' to prompt the user to touch the touch screen 14 and the hardkeys 16, 18 in the process of changing parameters or inputtinginformation into the computer system 100.

The touch screen 14 interfaces with the patient or other user and isprovided for inputting commands or information from the patient into ahuman interface (HI) board 108 and displaying messages on the display14' immediately behind the touch screen 14 surface in response tocommands from a host Central Processing Unit (CPU) 110 from the HI board108.

The hard keys 16, 18 and 20 are each a pair of physical, electricallyisolated switches. One switch in each of the hard keys 16, 18, and 20 ispreferably directly connected, and essentially hard wired, to a backupor safety CPU 116, and the other switch in the hard keys is connected toa host CPU 110. The switch for the emergency stop hard key 20 for thehost CPU 110 is preferably directly connected to host CPU 110 from theHI board 108 over a separate conductor, as shown by the dashed line 101.

While FIG. 3 shows the connection between the hard keys 16, 18 and 20going to the safety CPU 116 via the HI board 108 and conductor 105, theconnection between the hard keys and the safety CPU 116 is considered adirect connection since the only function performed by the HI board 108is debouncing and electrical interfacing the switch signals before theyare sent to the Safety CPU 116. The connection is also considered a"direct connection" in the sense the signal path is intentionallydesigned to not share any circuitry with the Host CPU 110 or themicroprocessor on the HI board 108.

The switch for the Red hard key 20 that is directed to the host CPU 110is directly connected to the host CPU via the HI board 108, whichperforms debouncing and electrical interfacing, but the circuit does notshare any other circuitry on the HI board 108 and the status of theswitch is sent to the host CPU over the conductor 101 as describedabove. The switch for the host CPU 110 for the green and blue hard keys18 and 16, respectively, are subject to debouncing by the microprocessoron the HE board 108, and the status of the switches is sent over the bus103.

A set of indicators 104, including lights and audio indicators, a buzzer121, and a speaker 106, alert the patient to abnormal conditions in themachine 10, and provide information as to the status of the modes ofoperation of the machine. The indicators 104 receive input signals fromthe host or safety CPU via the HI board 108. The buzzer 121 receivesinput signals from the safety CPU 116. Thus, audio and visual alarmactivities are split among the two microprocessors 110, 116 in case oneof them fails to work properly.

The host CPU 110 is connected via high speed digital data busses 111 and113 to a driver board 112 and an analog board 114. The host CPU 110comprises a microprocessor and implements a software program governingthe operation of the machine stored in a hard disk memory 130 or a readonly memory (not shown). The hard disk 130 stores other operationalinformation, such as the patient's prescription, data from the passivecomponents, and data input from the patient via the touch screen. Ananalog board 114 contains analog to digital converters for convertingincoming analog signals from the passive sensors in the machine 22 (suchas thermistors, pressure sensors and conductivity cells) into digitalsignals. The driver board 112 receives commands from the CPU 110 andsends the commands to the valves, pumps, heaters, motors, and otheractive components of the machine (represented by 120) to cause thecomponents to change their status, e.g., commence or cease operation orchange rate, as in the case of a pump, or open and close, as in the caseof a valve. The signals from the passive components 122 of the system,for example, the conductivity sensors, pressure transducers,thermistors, etc. provide their inputs to the analog boards 114 and 118.The CPU 110 and driver board 112 together act as a controller for theactive components.

The analog board 118 provides digital information on a bus 117 to thesafety CPU 116. The safety CPU 116 comprises a microprocessor and actsas watchdog of critical system sensors, and provides enable signals tothe driver 112 that allow certain driver commands to issue to the activecomponents 120 (such as signals to the valve and air pump to raise orlower the level in the drip chamber in the extracorporeal circuit).These features are described in more detail below as they relate to thechanging of machine parameters. Communications between the safety CPU116 and host CPU 110 are passed on data bus 107. The safety CPU 116activates a buzzer or other suitable alarm 121 if certain alarmconditions are present in the machine.

Both the host and safety CPUs 110 and 116 have an associated randomaccess memory 132 and 134, respectively, for use in processing inputinformation from the touch screen 14, for temporary storage of data, andfor performing other tasks. In a preferred embodiment, the host CPU 110and hard disk 130 are based on an off-the-shelf IBM compatible personalcomputer platform based on an Intel 386 or 486 microprocessor, or theequivalent. A similar microprocessor platform may be used for the safetyCPU 116. Of course, other types of microprocessor platforms may be used.The safety CPU 116 also has its own hard disk memory 123. Note that theSafety and Host CPUs 116 and 110 do not share a hard disk, but ratherhave their own hard disk, for safety and redundancy reasons.

The host CPU 110 preferably has a modem and telephone line interface, alocal area network (LAN) gateway card and interface and/or an RS-232serial port (not shown) for allowing the machine 10 to receive and sendmessages to remote locations by a suitable communication link. Thechoice of which type of input/output interface will depend on where themachine 10 is installed (e.g., the home (modem), in a hospital (LANinterface), in a nursing home (modem and/or RS-232 and/or LAN).Potential entities that may wish to access information from the machineinclude a physician or nurse, the machine manufacturer, a servicetechnician, and a remote monitoring facility such as a central stationmonitoring a plurality of machines. Preferably, machine status andtreatment information is stored in the hard disk 130 and is accessibleto the outside via the modem and host CPU 110 using an interactiveprogram running on the host CPU 110 and at the remote site. The host CPUcomputing platform 110 also preferably implements a Microsoft™ graphicaluser interface operating system, and also Internet access software toallow messages to be sent to and retrieved from the machine 10 via theInternet.

FIG. 4 is an elevational view of the user interface 12 of FIG. 1 showinga display on the touch screen 14 that is used prior to the start of thetreatment. The illustrated display, and preferably all of the displaysfor the user interface, is organized into discrete zones or portionsextending across the width of the display. This organizational schemeassists the user to know where to look on the display for certainfunctions, icons, and information throughout all of the displays. Oneportion is preferably devoted to displaying instruction and statusinformation to the user. Another is preferably devoted to displayingprimary treatment and machine activities and functions. A third portionis preferably used for secondary machine activities and functions.

An embodiment of this general organizational scheme is shown in FIG. 4.The display has an upper portion 60 devoted to secondary activities andfunctions, and includes an icon 62 for a guide, which allows the user togain information as to the machine when the icon 62 is pressed, amessages icon 64 indicating whether the patient has received newmessages (e.g., via the Internet or public telephone network), and aproblem report icon 66. The problem report icon 66 is a means for themachine to notify the patient of problems in a non-treatment mode. Thescreen display also has a time and day section 68.

The middle portion of the display 70 conveys status information to thepatient, such as when the next treatment time is to begin. The portion70 is given a paper pad type of look to reinforce the role played bythis portion of the screen.

The lower portion 72 has a set of icons related to primary treatment andmachine functions. These icons, when pressed, lead to additional screensthat allow the patient to obtain information or enter data as to basicmachine and treatment functions. These icons include an icon indicatingtreatment information 74, a dialysis schedule icon 76, a prescriptionicon 78 and a machine set-up icon 80.

When the user wishes to enter information into the machine from any ofthese menus, the user presses the touch screen 14 to navigate throughvarious screen displays until they arrive at the appropriate screen forthe action they wish to take.

As noted above, the user interface of FIG. 4 has at least one hard key(a physical button) positioned below the touch screen 14. Three hardkeys are preferably provided, each with a distinctive visual appearanceto assist the user to identify the hard key with a distinct functionalattribute: a blue hard key 16, a green hard key 18 and a red hard key20. The hard keys 16, 18 and 20 preferably consist of two electricallyindependent switches, one sending signals to the safety CPU 116 and theother sending signals to the HI board and host CPU 110 as describedabove.

The blue hard key 16 is connected to the host CPU 110 via the HI board608, and is hard wired to the safety microprocessor 116. The blue hardkey 16 is solely associated with an entry function. The user presses theblue hard key 16 when the user is finished editing a parameter duringthe process of changing parametric values for the machine. The blue hardkey 16 is directly hard wired to the safety CPU 116 due to the fact thatthe safety CPU 116 is involved when parametric values are changed, asdiscussed below.

The green hard key 18 is a means for the user to confirm parametricvalue changes and some of the mode transitions of the machine 10. Thegreen hard key 18 is connected to the host CPU 110 via the userinterface software and hardware (i.e., HI board 108) and is hard wiredto the safety CPU 116. The meaning associated with the pressing of thegreen hard key 18 also depends on the context of the current display andthe current state of the machine 10. Due to safety considerations, thesafety CPU 116 must have an independent means for determining the user'sintention to change parametric values, i.e., independent of the touchscreen or the host CPU, hence the green hard key 18 is directlyconnected and essentially hard wired to the safety CPU 116.

The red hard key 20 is a means for the user to issue an "Immediate Stop"command to the machine 10. The host and safety CPUs 110 and 116 respondby disabling a predetermined group of active components of the machinethat leaves the machine in a patient-safe mechanically stoppedcondition. The meaning of the red hard key 20 is always the sameregardless of the state of the machine 10. Unlike the blue and greenhard keys, the red hard key 20 is directly connected and essentiallyhard wired to both the host and safety CPUs. Both microprocessors havethe ability to disable the same group of active components, and will,redundant with each other, disable the active components.

As noted above, in order to assist the user to become familiar with thefunctions provided by the hard keys, they are preferably given adifferent color. Since one of the keys 20 is associated with anemergency stop function it is given a red color. The other keys 16 and18 have more latitude in their selection of color, and we prefer to usea green key 18 to be generally identified with a confirmation function.The third key 16 is identified with an entry function, and is blue inthe preferred embodiment. To assist further in reinforcing theirdifferent functions, they may be given different shapes, e.g., octagon,square and triangle. Other colors and shapes are of course possible.

In accordance with the invention, the touch screen 14 and hard keys 16and 18 are used in a process to adjust certain parameters pertinent tothe operation of the machine or the dialysis treatment. FIG. 5 is anillustration of the user interface 12 showing a display on the touchscreen 14 that can be accessed before or during the dialysis session.The touch screen 14 displays a message prompting a user to touch an icon140 if they wish to change the level of the drip chamber in theextracorporeal circuit. When this icon 140 is pressed, an illustrationof the blood drip chamber is displayed on the screen and the userindicates the current level in the illustration. The host CPU determinesfrom the indicated level whether the level needs to rise or fall, and byapproximately how much, to bring the level back to a predetermineddesired level. This process and variations thereto are described infurther detail in the above-referenced Kenley et al. patent applicationfiled concurrently, Ser. No. 08/799,227 filed Feb. 14, 1997 incorporatedby reference herein.

The display of FIG. 5 further includes several icons 142, 144, 146, 148,150 and 152 that display current treatment settings in numerical form.The region 154 below the icons 142, 144, etc. can be used to displayother information or to allow the patient to navigate to the previousscreen or additional screens, obtain information, or report problems.

The display of FIG. 5 requests the patient to press an icon associatedwith a treatment parameter if they wish to initiate the process ofchanging the parameter. When the user presses an icon, for example, thetreatment length icon 148, the display is modified to that shown in FIG.6. Up and down arrows appear below the icons 142, 144, 146 et al.adjacent to the selected treatment parameter and the treatment parametericon 148 is highlighted, e.g., made a brighter or a different color fromthe other icons. The user presses the up or down buttons 180, 182 toselect the new value. The user then signifies that the editing iscomplete by pressing the blue hard key 16. After verification proceduresare performed, the user is then prompted to confirm the change bypressing the green hard key 18.

In the preferred embodiment of the invention, the above process invokesoperations with both the host and safety CPUs 110 and 116 to provideredundancy and safety features, which will now be described in detail inconjunction with FIGS. 3, 5 and 6.

The user touches one of icons 142, 144, 146, 148, 150 and 152 toindicate which parameter they wish to edit. A pair up and down arrowssuch as shown in FIG. 6 then appear. The user presses the up and downicons to select the new parametric value. In response to a prompt, theuser indicates that the editing process is complete by pressing the bluehard key 16. An alternative would be to prompt the patient to press thegreen hard key, but this is a less desirable alternative sinceassociation of the green hard key 18 with a confirmation function wouldbe diluted. A further possibility would be to press the activated icon,e.g., icon 144, a second time in response to a prompt. The preferredaction of pressing the hard key 16 off the touch screen 14 initiatesstorage of the changed parametric value into the working RAM 132 forhost CPU 110 (FIG. 3). A CRC (Cyclical Redundancy Check) value iscalculated by the host CPU 110 for the set of parametric valuescurrently displayed on the screen. The CRC check is calculated by thehost CPU 110 only (at this point), and only in response to the pressingof the blue or entry hard key 16.

The following information is then sent from the host CPU 110 to thesafety CPU 116 over the bus 107 in response to a pressing of the entryhard key 16: a unique screen identifier associated with the displaycurrently on the touch screen 14, the current values of all themodifiable parameters displayed on the screen, a unique parameteridentifier associated with the parameter to be changed, and thecalculated CRC value. The data is stored in the Safety CPU 116's RAM134.

The safety CPU 116 then performs a verification routine to determinethat the requested change to the parameter is appropriate for thepatient and is consistent with the current status of the machine 10 andcurrent display, and prevent any changes that could be harmful to thepatient. Specifically, in a preferred embodiment, the safety CPU 116verifies that the screen displayed could be displayed given the currentstate of the machine 10. It also verifies that only one parametricvalue, of all the modifiable parametric values associated with thecurrent screen, has changed. It also verifies that the parameteridentified by the host microprocessor 110 is editable on the specifiedscreen. If further verifies that the parameter that the host hasidentified as being the changed parameter is the same one identified bythe safety CPU 116. This verification is done by the Safety CPU 116using its own copy of the treatment information stored in its hard disk123 and comparing this information with the information sent from thehost CPU 110 to determine which parameter for the screen has changed.The safety CPU 116 further verifies that the parametric value thatchanged passes all range, resolution, format and other appropriatevalidation and safety tests. This is accomplished by comparing theproposed new value with stored values on the hard disk 123 associatedwith permissible range of values and other validation criteria for thepatient. The values stored on the hard disk 123 may be either modifiableby a doctor's prescription loaded into the hard disk 123 or validationor safety criteria set at the time of machine manufacture. Finally, thesafety CPU 116 calculates a CRC on the set of parametric valuescurrently displayed and determines whether the CRC value matches the CRCvalue calculated by the host CPU 110. It will be appreciated that theabove specific verification routine is not the only possibleverification routine and can be modified to be more or less stringentfor different parameters and states of the machine.

If the safety CPU 116 detects an error in the verification routine itnotifies the host CPU 110 and treats the failure in a manner to that ofa triggered protective system, such as by displaying an error message oractivating one of the indicators 104 and/or the buzzer 121.

If the safety CPU 116 does not detect an error, it sends a signal to thehost CPU 110 indicating the tests were passed and notifying the host 110that the host 110 may continue. The safety CPU 116 transfers back to thehost CPU 110 the data stored in RAM 134 that was forwarded from the host110 (while keeping a copy in RAM 134), and the CRC calculated by thesafety CPU. This data is stored in work space in the host CPU's RAM 132.

The host CPU 110 then compares the CRC calculated by the safety CPU 116to the host's CRC value, compares all the parameter values returned bythe safety CPU 116 to the values it originally sent, and treats anymismatch in a manner similar to that of a triggered protective system.

If the comparison is valid, then the host CPU 116 updates the screendisplay with the parametric values returned by the safety CPU and storedin RAM 132. The host CPU 110 then causes the touch screen 14 to displaya prompt to the user that they must press the green hard key 18 toconfirm the pending change to the displayed parametric value. Note that,up until this point, the data associated with the changed parameter isnot yet loaded into the hard disk 130 that contains the program, andthus the machine cannot operate in accordance with the selectedparametric value. Rather, a confirmation step must still occur, i.e., apressing of the green hard key 18 off of the touch screen.

When the user presses the green hard key 18 to confirm the change, thehost microprocessor calculates a new CRC file and then writes the RAM132 copy of the parameters and the CRC to the hard disk 130. The safetyCPU 116 simultaneously performs the same actions with its copy of theCRC and the parameters stored in RAM 134, writing the RAM copy and CRCvalue to its hard disk 123. Both host and safety CPUs will then reloadtheir sets of parameter and CRC data into their respective RAM andverify with each other that the new CRC value agrees with each other.The host CPU 110 then removes the "Press the green key to confirm"prompt and enables a screen navigation prompt allowing the user tonavigate through other screens. At this point, the user can eithernavigate off the screen of FIG. 6 or select another parameter forediting. The changing of the parametric value is now complete since theparametric value data is loaded into the hard disks of the host andsafety CPU.

While the above discussion has assumed that the user only modifies oneof the several parameters from the display of FIG. 6, the user maychoose to modify another parameter on the same screen after the bluehard key 16 has been pressed. The user does not have to press the greenhard key for every single parameter change. For example, the user mayselect a new blood flow rate (using icon 142), then press the blue hardkey 16 to signify completing of the editing process, select a new fluidremoval rate (using icon 146), then press the blue hard key 16, thenedit the dialysate temperature (using icon 150), and then press the bluehard key 16. After each pressing of the blue hard key 16, theabove-described verification routine is performed. If the verificationroutine results in a positive result for each pressing of the blue hardkey, the display will continue to display a "press the Green hard key toconfirm" prompt. The user will press the green hard key once to confirmthat they intend to change all the parametric values that have beenselected.

Since the new updated parametric value(s) are now entered into the harddisk memory 130, the host CPU 110 commands the relevant activecomponents of the machine 10 in accordance with the new parametricvalue.

This use of the hard keys in the process of changing parametric valuesis considered to be distinctly different and an improvement from merelytouching the touch screen to enter or change values, since the touchscreen can be prone to failures. Failures in a touch screen to properlyrespond to a touching of the surface can arise in a variety of ways,such from mechanical failures due to repeated use over a prolongedperiod of time, the screen surface material taking on a depression orset in a particular area from repeated use, electro-static shock causingthe grid to fail in particular area, high electromagnetic fields causingthe contacts to touch, cleaning agents leaking around the periphery ofthe screen, and so on. By also using hard keys or physical switchesdirectly wired to the host and safety CPU to change values, themicroprocessors have an independent means for determining whether theuser has entered values or intends to confirm the changes. Further, byvirtue of connecting the hard keys to both microprocessors, and usingthe pairs of redundant host and safety memories to check against eachother, a failure in either microprocessor or associated memories will bedetected, allowing for alarms or other protective action to be initiatedwhile maintaining patient safety,

The above-described method of using the touch screen and hard keys tochange machine or treatment parameters is also applicable to changingoperational modes in the machine. For example, if the machine 10 is in aprepare dialysate solution mode, the display 14 may display a promptindicating that the user should press the green hard key to indicatethat they are ready to enter into a prepare access site mode or adialyze mode. Another example would be when the user is finishing thedialysis session and indicates to the machine that they are ready to enddialysis and begin a rinseback mode. The user is prompted to press ahard key (e.g., the green hard key) to indicate that they wish toconfirm that they are ready to start the next mode of operation.Further, by virtue of the connection of the hard keys to both the hostand safety CPUs, a verification routing can be performed by both CPUs toconfirm that the machine is in a state where the change is mode is safefor the patient.

For some mode changes, it is presently contemplated that little or nouser interaction with the machine is necessary. For example, thetransition from a clean and rinse mode to a prepare dialysate solutionmode may be made without requiring user involvement. However, thecurrent mode of operation is preferably communicated to the patient,such as by displaying a message telling the user what mode the machineis in (e.g., clean and rinse mode) and an illustration communicating howmuch time remains until the machine has completed the present mode.

It will be appreciated that various modifications may be made to themethods described herein without departure from the true scope andspirit of the invention. Furthermore, as used in the claims, the term"touch screen" is intended to mean the combination of the transparentphysical surface touched by the user and the display immediately behindthe surface touched by the user. The term "hard key", as used in theclaims, is not intended to be limited to a button or key having twophysical switches directed to host and safety CPUs, but rather, unlessotherwise stated, is intended to mean simply a manually manipulablephysical switch off of the touch screen such as a button operativelyconnected to a central computer system for the medical instrument. Thistrue scope and spirit is defined by the appended claims, interpreted inlight of the foregoing specification.

We claim:
 1. A system for controlling the operation of a dialysis machine, comprising, in combination:a) a user interface comprising:1) a touch screen displaying messages and information as to said machine to a user and permitting said user to touch said touch screen to select at least one parametric value pertinent to operation of said machine or pertinent to a treatment by said machine, and 2) at least one hard key off of said touch screen, said touch screen operable for prompting said user to press said hard key to signify that the selection of said at least one parametric value by said user has been completed; b) a control system within said machine for controlling operation of said machine and responsive to said touch screen and said at least one hard key, said control system comprising a host processing unit and a safety processing unit, said host processing unit and said safety processing unit operatively connected to said hard key and to each other so as to respond to a pressing of said hard key and to enable an exchange of information related to said at least one selected parametric value, c) wherein said pressing of said hard key causes said host and safety processing units to undergo a verification routine whereby information as to said selected parametric value is passed from said host processing unit to said safety processing unit said safety processing unit checking said selected parametric value to confirm that said parametric value meets validation or safety criteria for a patient connected to said machine so as to prevent changes to said parametric value potentially harmful to said patient.
 2. The system of claim 1, wherein said hard key is directly wired to said safety microprocessor so as to permit said safety microprocessor to reliably respond to a pressing of said hard key.
 3. The system of claim 1, wherein said said at least one hard key comprises first, second and third hard keys, said first hard key associated with an emergency stop function for said machine, said second hard key associated with an entry function for entering said selected at least one parametric value, and said third hard key associated with a confirmation function for confirming that the at least one entered parametric value is intended by said user of said machine, said touch screen prompting said user to touch either said second hard key or said third hard key after said user has touched said touch screen to select said at least one parametric value.
 4. The system of claim 1, wherein said at least one hard key comprises first and second hard keys, said first hard key having a first color and said second hard key having a second color distinctly different from said first color, said control system performing said verification routine upon the pressing one of said first or second hard keys.
 5. The system of claim 4, wherein said user interface further comprises a third hard key having a third color, wherein said first color comprises red, and said third color comprises green.
 6. The system of claim 1, wherein said at least one hard key comprises first, second and third hard keys, each of said first, second and third hard keys hard wired to said safety microprocessor, said control system performing said verification routine upon the pressing one of said first, second or third hard keys.
 7. The system of claim 1, wherein said at least one hard key comprises a first hard key and a second hard key, and wherein said user presses a second hard key to confirm that said selected at least one parametric value is intended by said user.
 8. A method of changing a parametric value pertinent to operation of a dialysis machine, said machine having a user interface comprising a touch screen, a first hard key and a second hard key, and a control system responsive to said first and second hard keys comprising a host processing unit and a safety processing unit, said host and safety processing units each having a first memory and a second memory storing machine operation instructions, the method comprising the steps of:a) displaying on said touch screen a display permitting a user to touch said touch screen to select a parametric value associated with a parameter pertinent to operation of said machine or pertinent to a dialysis treatment conducted by said machine; b) pressing said first hard key to enter said selected parametric value, said control system responsively storing said selected parametric value in said first memory associated with said host processing unit; c) in response to pressing said first hard key, transmitting data associated with said parametric value and said parameter from said host processing unit to said safety processing unit and implementing a verification routine in said safety processing unit, wherein said parametric value is checked to confirm that said parametric value meets validation or safety criteria for a patient connected to said machine so as to prevent changes to said parametric value potentially harmful to said patient; d) if said verification routine indicates that said parametric value meets said validation or safety criteria, prompting said user to press said second hard key to confirm the change selected in step a) and responsively pressing said second hard key and storing said data associated with said parametric value in said first memory associated with said safety processing unit; e) storing in said second memory associated with said host and safety processing units said data associated with said parametric value; and f) checking, with said host and safety processing units, the contents of their respective first and second memories against each other to insure that said data associated with said parametric value stored in their respective first and second memories is the same.
 9. The method of claim 8, wherein said second memory associated with said host processing unit comprises a hard disk storing a prescription for said patient connected to said machine.
 10. The method of claim 8, wherein said first and second hard keys are directly connected to said safety processing unit.
 11. A method of changing a parametric value pertinent to operation of a dialysis machine, said machine having a user interface comprising a touch screen, a first hard key and a second hard key, and a control system responsive to said first and second hard keys comprising a host processing unit and a safety processing unit, said host and safety processing units each having a first memory and a second memory storing machine operation instructions, the method comprising the steps of:displaying on said touch screen a display permitting a user to touch said touch screen to select a parametric value associated with a parameter pertinent to operation of said machine or pertinent to a dialysis treatment conducted by said machine, pressing said first hard key to enter said selected parametric value, said control system responsively storing said selected parametric value in said first memory associated with said host processing unit; in response to pressing said first hard key, transmitting data associated with said parametric value and said parameter from said host processing unit to said safety processing unit and implementing a verification routine in said safety processing unit, wherein said parametric value is checked to confirm that said parametric value meets validation or safety criteria for a patient connected to said machine so as to prevent changes to said parametric value potentially harmful to said patient; if said verification routine indicates that said parametric value meets said validation or safety criteria, prompting said user to press said second hard key to confirm the change selected in step a) and responsively pressing said second hard key and storing said data associated with said parametric value in said first memory associated with said safety processing unit: storing in said second memory associated with said host and safety processing units said data associated with said parametric value; and checking with said host and safety processing units, the contents of their respective first and second memories against each other to insure that said data associated with said parametric value stored in their respective first and second memories is the same, wherein said verification routine comprises the steps of: calculating with said host processing unit a first cyclical redundancy check value associated with said selected parametric value; transmitting from said host processing unit to said safety processing unit, in addition to said parametric value, said first cyclical redundancy check value, a first identifier associated with a screen displayed by said touch screen during said step of selection of said parametric value, and a second identifier associated with said parameter; calculating with said safety processing unit a second cyclical redundancy check value associated with said data;(1) verifying with said safety processing unit from said first and second identifiers that said touch screen could display said screen given the current state of said machine and that said parameter may be changed on said screen; (2) verifying with said safety processing unit that said parametric value associated with said data is within a predetermined range associated with said parameter, and (3) verifying with said safety processing unit that said second cyclical redundancy check matches said first cyclical redundancy check; and, in the event that each of said verification steps (1), (2) and (3) results in a positive result, transmitting an approval signal from said safety processing unit to said host processing unit indicating that said positive result was achieved.
 12. An improved user interface and screen display apparatus for a dialysis machine that promotes ease of use of said user interface by a user operating said machine without immediate supervision by trained professional medical personnel, comprising:a) a touch screen; b) a screen display for said touch screen, said screen display arranged in at least two portions extending across said display, said at least two portions comprising:1) a first portion displaying instruction and status information to a user of said machine; and 2) a second portion adjacent to said first portion on said display and displaying a plurality of icons, each of said icons associated with specific functional attributes of either said machine or a treatment session of said machine; c) at least one hard key associated with said display, said first portion of said screen display operable for prompting said user to press said at least one hard key in a process of entering or confirming entry of information into said machine; and d) a host processing unit and a safety processing unit, said host and safety processing units in communication with each other and both responsive to pressing of said at least one hard key, said pressing of said at least one hard key causing said host and safety processing units to perform a verification routine to confirm that changes to machine operation or treatment parameters meet safety or validation criteria for a patient connected to said machine.
 13. The apparatus of claim 12, wherein at least one of said icons is selected from the group of icons consisting of a treatment icon, a schedule icon, a prescription icon, and a setup and care icon.
 14. The apparatus of claim 12, wherein said machine is coupled to a transmission medium allowing said machine to receive messages from a source remotely of said machine, and wherein said first and second portions are arranged above each other and extend across the width of said display, and wherein said screen display further comprises a third portion adjacent to said first and second portions, and wherein said third portion of said screen display displays a plurality of icons, at least one of said icons associated with a message transmission or receiving function for said dialysis machine and indicating whether said machine has received a message from said remote source.
 15. An ergonomically efficient and easy to use human interface for a dialysis machine, said dialysis machine having an enclosure containing hydraulic circuitry for said machine comprising:an arm having a proximal end connected to said machine and a free distal end portion; a display assembly connected to said free distal end portion of said arm, said display comprising a touch screen said display assembly further comprising three hard keys positioned adjacent to said touch screen each hard key having a distinctly different appearance from the other of said hard keys and each hard key associated with a different function with respect to machine operation or the entry of parametric value information into said machine, and a control system for said instrument requiring a touching of both said touch screen and a pressing of at least one of said hard keys in order to effectuate a change in said parametric value information; wherein said proximal end of said arm is mounted to said machine in a manner permitting said arm to rotate about a vertical axis relative to said machine to thereby position said display assembly at the distal portion thereof in a multitude or different positions relative to said machine; and wherein said display assembly is connected to said free distal end portion of said arm by first and second hinges permitting a user of said machine to rotate said display assembly about two different axes relative to said arm.
 16. The user interface of claim 15, further comprising a handle portion below said touch screen comprising a lower lip enabling a user to grasp said user interface housing and a front surface extending across a portion of the width of said housing, said lower lip and said front surface enabling a user to manually manipulate said user interface housing in a manner to cause rotation of said user interface about said at least one axis relative to said machine and said at least one axis relative to said arm.
 17. An ergonomically efficient and easy to use human interface for a medical instrument especially suited for use by a user other than trained professional medical personnel, comprising:a) a display assembly comprising a housing having a front surface; b) a touch screen incorporated into said front surface of said display assembly said touch screen displaying information as to machine operation parameters; c) first, second and third hard keys incorporated into said front surface of said display assembly and placed adjacent to said touch screen, said touch screen operable for displaying a message prompting said user to press both said touch screen and at least one of said first, second and third hard keys during operation of said human interface of said medical instrument to change a parameter pertinent to said instrument or pertinent to a treatment performed by said instrument on said patient; d) wherein each of said first second and third hard keys presents a substantially different visual appearance to a user so as to readily permit said user to associate each of said plurality of hard keys with a different functional attribute associated with said operation of said human interface; and d) a control system for said instrument requiring a touching of both said touch screen and a pressing of at least one of said hard keys in order to effectuate said change in said parameter.
 18. The user interface of claim 17, wherein each of said first, second and third hard keys are provided with a distinctly different color.
 19. The user interface of claim 18, wherein at least one of said hard keys has a distinctly different shape from the other two of said hard keys.
 20. The user interface of claim 18, wherein said first hard key has a red color and associated with a emergency stop function, said second hard key has a blue color and is associated with an entry function, and said third hard key has a green color and is associated with a confirmation function, said first, second and third hard keys located adjacent said touch screen on said front surface of said display assembly.
 21. The user interface of claim 18, wherein said display assembly is mounted to a free end of an arm connected to said medical instrument, with said arm rotatable relative to said medical instrument about a vertical axis and with said display assembly comprising first and second hinges to as to permit said display assembly to be rotatable relative to said free end of said arm about a horizontal axis and a vertical axis. 